The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary functionality is to automate project governance tasks through the execution of CLI tools. It invokes git, uv, and node, as well as project-specific hooks defined in configuration files like release-workflow.json. The runner scripts (project-governance.py, release-workflow.py) implement path containment validation to ensure that invoked scripts remain within the repository root and require an --authorized flag for any non-read-only operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the repository, including Markdown documents (requirements, plans, defects) and CSV files (test-case catalogs). While this data is parsed into structured JSON objects by the scripts before being returned to the AI agent, the content of these records could theoretically contain instructions intended to influence the agent's behavior. The skill documentation emphasizes the need for semantic review and human verification to mitigate this surface risk.
[DATA_EXPOSURE]: The skill manages a local registry of project segments and ports in the user's home directory (~/.agents/skills-config/project-governance/). This configuration is accessed with appropriate file permissions (0600/0700) to protect local machine settings while enabling cross-project coordination.

project-governance